fix CORS test